Maven 4.0.0-rc-6
- Accept Java module names as attached artifactId even if they differ from the project's artifactId
- Add module-aware resource handling for modular sources
- Maven 4 now enforces stricter POM validation, rejecting duplicate XML elements like artifactId and properties
- Maven 4 now rejects duplicate dependency declarations with the same groupId:artifactId
- Maven 4 no longer silently accepts uninterpolated expressions in repository URLs, distribution management IDs, and other fields
- Maven 4 no longer interpolates properties in module elements at POM reading time
- Maven 4 applies dependencyManagement at all transitive depths instead of only at the first level
- Use hardlink instead of file copy for improved performance
- Reduce allocation pressure in model building pipeline
- Fixed bean configuration bug where field accessibility state was cached globally, causing plugin configuration injection failures
- Fixed concurrency issue in the v4 API that caused ConcurrentModificationException
- Fixed BOM packaging consumer POM conversion to correctly preserve dependency versions
- Removed extracted JLine native binaries from distribution that triggered macOS Gatekeeper
Notes
This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has restricted a few things compared to Maven 3, so make sure to run the mvnup tool before trying your project with Maven 4.
Issues fixed since RC-5
All known issues reported in the RC-5 release notes have been fixed:
- Bean configuration bug — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in #11433.
- Concurrency issue in the v4 API — a
ConcurrentModificationExceptionwas fixed in #11429. - BOM packaging — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in #11464.
- macOS Gatekeeper — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (#11997). The
xattrworkaround from RC-5 is no longer needed.
Known compatibility issues
The following are known compatibility issues when using Maven 4. Running
mvnup before building with
Maven 4 will fix many common plugin version issues automatically. The issues
below are those that require manual intervention or upstream fixes.
Stricter POM validation
Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:
- Duplicate XML elements — duplicate
<artifactId>,<properties>, etc. are now rejected (Duplicated tagerror). Fix the source POM. - Duplicate dependency declarations — same
groupId:artifactIddeclared twice is now rejected (must be unique). - Uninterpolated expressions —
${...}expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected. - Invalid XML in transitive POMs — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause
Non-parseable POMerrors. - Properties in
<module>paths — Maven 4 no longer interpolates properties like${spark.version}in<module>elements at POM reading time. - CI-friendly versions — projects using
${revision}withoutflatten-maven-pluginmay hit missing dependency version errors. - Invalid Collect Request — transitive dependencies with uninterpolated
${...}version expressions are rejected.
Transitive dependency resolution changes
Maven 4's TransitiveDependencyManager applies dependencyManagement at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:
- Dependencies previously on the classpath may disappear — add explicit declarations. See #12302.
maven-enforcer-pluginversion rules may trigger due to downgraded transitive versions.license-maven-pluginmay report new transitive dependencies not in the allow-list.- Karaf feature verification may fail due to OSGi bundle version mismatches.
Plugin and extension compatibility
Some plugins and extensions require specific versions for Maven 4:
- Quarkus — versions before 3.20 use
ServiceLocator/RepositorySystempatterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+. - Tycho — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.
- Develocity Maven extension — fails to initialize due to SLF4J classloading changes (
ClassNotFoundException: SimpleLogger). - pgpverify-maven-plugin — versions before 1.20 hit a
ClassCastExceptionwith Maven 4's resolver. See resolver#1957. - cyclonedx-maven-plugin — fails with
Invalid Version Range Requestwhen using${revision}CI-friendly versions. - maven-site-plugin — Velocity template rendering may fail with incompatible site plugin versions.
- maven-shade-plugin —
dependency-reduced-pom.xmlcan causeThe parents form a cycleerror. - commons-release-plugin —
clean-stagingfails under Maven 4.
Classloading changes
- Plugins relying on Maven 3's classrealm layout may encounter "foreign imports" errors (e.g., Quarkus, JAXB plugins).
- Maven 4's prefix-based repository routing may block artifacts not matching
/.meta/prefixes.txt.
Post-mvnup formatting
- spotless-maven-plugin and sortpom-maven-plugin may report formatting violations after
mvnupmodifies POM files. Re-run the formatter aftermvnup.
Other
- Broken upstream POMs — e.g.,
hadoop-project3.1.0–3.3.0 has invalid XML (<Xlint:-unchecked/>) causing parse errors. These need upstream fixes tracked in HADOOP-19923. - Enforcer POM element ordering — Maven 4's model builder reorders POM elements into a canonical order, which can break enforcer rules checking element ordering.
- SNAPSHOT handling — SNAPSHOT artifacts may show as "present, but unavailable" under Maven 4's different resolver metadata handling.
🚀 New features and improvements
- Backport the use of hardlink instead of file copy (#11564) @desruisseaux
- Accept Java module names as attached artifactId even if they differ from the project's artifactId (#11573) @desruisseaux
- Add module-aware resource handling for modular sources (#11700) @desruisseaux
- [MNG-8507] - Reduce allocation pressure in model building pipeline (#12540) @gnodet
- [Backport 4.0.x] Fix #12530: add mvnup upgrade strategies for Maven 4 known compatibility issues (#12560) @gnodet
- Introduce validation control (#12548) @cstamas
- Backport #12505: mvnup: widen exact Maven version pins to allow Maven 4 (#12508) @gnodet
- [MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#12473) @slawekjaranowski
- Backport #12454: mvnup upgrade strategies and compatibility improvements (#12467) @gnodet
- In failed build limit reactor summary to only failed modules (#12469) @slawekjaranowski
- [Backport 4.0.x] Add mvnup SourceStrategy for migrating to elements (#12357) @gnodet
- [Backport 4.0.x][#12353] Add jaxb2-maven-plugin to mvnup plugin upgrade list (#12356) @gnodet
- [Backport 4.0.x] Switch default resolver transport from JDK/methanol to Apache HttpClient (#12341) @gnodet
- Feat: Pull out maven-executor into its own project (#12004) (#12186) @cstamas
- [maven-4.0.x] Add maven-surefire-report-plugin to PluginUpgradeStrategy (#12114) @gnodet
- [maven-4.0.x] Fix #12087: add surefire and failsafe plugins to PluginUpgradeStrategy (#12109) @gnodet
- Backport: Maven Executor Fixes (#11987) @cstamas
- Promote java version in JavaToolchain (#11971) @slawekjaranowski
- Add time zone to Maven startup banner (#11781) @slawekjaranowski
- Update formatting of prerequisites-requirements error to improve readability (#11525) @slawekjaranowski
🐛 Bug Fixes
- Remove an optimization on PathSelector producing false negatives (#12623) @desruisseaux
- Remove erroneous path normalization optimization + regression test (#12621) @gnodet
- Fix #12583: Inverted file existence check in DefaultTransport.put() (#12619) @gnodet @elharo
- [MNG-8507] mvnup: skip dedup inside plugin
<configuration>elements (#12582) @gnodet - Fix BOM consumer POM leaving property references unresolved (#12627) @gnodet
- Use resource filtering for mng-12534 IT plugin mavenVersion to avoid hardcoded versions (58cb473) @gnodet
- [MNG-8425] Fix mvnenc init saving invalid master source configuration (#12564) @gnodet
- Consumer POM of multi-module project should exclude and elements (#11764) @desruisseaux
- Fix #12045: fix mvnup plugin upgrade strategy for inherited plugins from remote parent POMs (#12054) @gnodet
- Backport #12538: Handle Ctrl+C on Windows terminals (#12550) @gnodet
- [Backport 4.0.x] Fix #12531: filter NO_REPOSITORY sentinel from mapped exceptions in ArtifactResolverResult (#12561) @gnodet
- [Backport 4.0.x] Fix #12534: Wire up @After annotation processing in Maven core (#12566) @gnodet
- [Backport 4.0.x] Fix #12427: Reject path-traversal segments in coordinate ids and versions (#12565) @gnodet
- [Backport 4.0.x] [MNG-11147] - Fix BOM version inference for sibling modules in dependencyManagement (#12569) @gnodet
- Backport #12523 to 4.0.x: preserve unresolved ${...} in CLI -D values (#12524) @ascheman
- [Backport 4.0.x] Avoid IllegalStateException on duplicate profile ids in DefaultModelBuilder (#12506) @ascheman
- Backport #12446: Fix deadlock in AbstractRequestCache (#12468) @gnodet
- Fix #12464: Skip MAVEN_ARGS for non-default main classes (backport to 4.0.x) (#12466) @gnodet
- Bugfix: use GAV and not GAPV in source labels for profiles (#12406) (#12424) @cstamas
- [#11449] Fix Mockito agent: use late binding @{} interpolation (backport to 4.0.x) (#12415) @gnodet
- Make LookupContext#closeables thread safe (backport to 4.0.x) (#12414) @gnodet
- [#11683] Install JUL-to-SLF4J bridge to route java.util.logging through Maven logging (#12345) @gnodet
- [#12303] Fix CI-friendly ${revision} not interpolated for non-build POM reads (#12322) @gnodet
- [4.0.x] Fix mvn.cmd jvm.config read failing silently on Windows CI (#12379) @gnodet
- [Backport 4.0.x] Fix mvnup spurious pluginManagement injection for remote parent plugins (#12351) @gnodet
- [MNG-8650] - Fix MAVEN_ARGS backslash stripping on Windows (#12349) @gnodet
- Port #11908: Do not force metadata download for plugin prefix resolution (#11905) (#12343) @gnodet
- [Backport 4.0.x] Fix NPE in DefaultLookup.lookupOptional() when container returns null (#12340) @gnodet
- [#12301] Use stack-passed Set for activeModelReads cycle detection (#12325) @gnodet
- [Backport 4.0.x] Sync DefaultTypeProvider and dependency-types docs across impl and compat (#12326) @gnodet
- [#12301] Fix StackOverflowError with internal parent and CI-friendly revision (#12314) @gnodet
- [Backport 4.0.x] [#12288] Add -P !profile deactivation regression guard (#12298) (#12315) @gnodet
- [maven-4.0.x] Fix #12305: filter uninterpolated deps in ArtifactDescriptorReaderDelegate (#12309) @gnodet
- [maven-4.0.x] Fix #12304: replace deprecated property expressions in mvnup (#12308) @gnodet
- [maven-4.0.x] Fix #12306: normalize targetPath in DefaultSourceRoot (#12307) @gnodet
- [Backport 4.0.x] [#12288] Pass settings.xml profile properties to LRM (#12299) @gnodet
- Fix thread-safety in DefaultModelValidator (backport to 4.0.x) (#12284) @gnodet
- Fix MojoExtension.beforeEach to use merged model instead of raw parsed model (backport to 4.0.x) (#12287) @gnodet
- Fix BUILD_CONSUMER profile activation for locally-resolved parent POMs (backport to 4.0.x) (#12286) @gnodet
- Fix NPE in DefaultModelBuilder when POM resolved from repository (backport to 4.0.x) (#12285) @gnodet
- Backport #12053: Tokenize arithmetic operators as delimiters in ConditionParser (#12275) @gnodet
- Backport #12117: Support sealed parameter implementation hints (#12258) @gnodet
- Backport #12038: Fix ConditionParser to handle newlines before && operator (#12259) @gnodet
- Backport #12146: Handle missing package metadata in model ids (#12257) @gnodet
- Backport #11742: Fix #11715: preserve 4.1.0 namespace/schema in help:effective-pom (#12255) @gnodet
- Backport #12237: Add XmlService classloader fallback for ServiceLoader discovery (#12254) @gnodet
- Avoid reflective InputSource modelId mutation (#12147) @Will-thom
- Fix MavenITConsumerPomBomFromSettingsRepoTest missing super constructor call (#12253) @gnodet
- fix reportSet inheritance in Maven 4 model building (#12245) @hboutemy
- [4.0.x] [GH-11772] - Fail-fast consumer POM validation for non-4.0.0 model versions (#12236) @gnodet
- [4.0.x] Fix Source.targetPath incorrectly aligned to basedir (#12235) @gnodet
- [4.0.x] Fix #11856: Improve error message for prefix-based remote repository filtering errors (#12234) @gnodet
- [4.0.x] Fix #11796: Preserve default-phases bindings for standard lifecycle phases (#12233) @gnodet
- [4.0.x] Fix @PreDestroy ClassNotFoundException from premature ClassRealm disposal (#12232) @gnodet
- [4.0.x] [MNG-6772] - Re-enable integration test for nested import scope repository override (#12231) @gnodet
- Fix deadlocks in request cache (unstable hashCode, re-entrant self-deadlock, mutable properties) (#12166) @gnodet
- [maven-4.0.x] Backport bug fixes from #11741 and #11733 (#12144) @gnodet
- [backport maven-4.0.x] Fix logging setup/teardown order (#12137) @gnodet
- Fix domtrip API breakage after 1.5.1 upgrade (#12138) @gnodet
- Update binary distribution LICENSE with complete Apache License 2.0 text (#12116) @slawekjaranowski
- Fix #11899: Default addLocationInformation to false in Settings and Toolchains XML writers (#12123) @gnodet
- [maven-4.0.x] Fix mvn script expanding ${...} in CLI arguments (#12095) @gnodet
- [maven-4.0.x] Fix consumer POM serialization of prefixed XML attributes (fixes #11760) (#12110) @gnodet
- Fix #11885: Disable ANSI colors when stdout is piped on JDK 22+ (backport) (#12111) @gnodet
- [maven-4.0.x] Fix #12085: regression tests for version inheritance from remote parent (#12101) @gnodet
- Fix #12074: prevent false parent cycle with shade plugin's dependency-reduced-pom.xml (#12079) @gnodet
- Fix #12075: skip expression validation for distributionManagement repository IDs (#12076) (#12077) @gnodet
- [maven-4.0.x] fix: restore buildConfiguration() callback in deprecated build() methods (#12094) @gnodet
- [maven-4.0.x] fix: propagate addResource() to model Build for Maven 3 compat (#12093) @gnodet
- [maven-4.0.x] Filter transitive repositories with uninterpolated IDs (#12049) (#12070) @gnodet
- Downgrade plexus-classworlds from 2.11.0 to 2.9.0 (#12092) @gnodet
- [maven-4.0.x] Fix #11920: skip expression validation for profile repository URLs (#12055) @gnodet
- Mvn4: Remove extracted Mac OS JLine binaries from Maven distro (#11997) @kwin
- Fixes issue #11827 - Maven DI crashes if the file org.apache.maven.api.di.Inject contains empty lines (#11830) @slawekjaranowski
- Backport the simplification and fixes of PathSelector (#11565) @desruisseaux
- [maven-4.0.x] Fix special characters in .mvn/jvm.config (fix #11363, #11485 and #11486) (#11365) (#11537) @gnodet
- Improve DefaultModelProcessor error reporting for alternative parsers (#11529) @gnodet
- Allow ${project.basedir} in profile activation.condition (#11528) @gnodet
- [maven-4.0.x] Fix profile source tracking in multi-module projects (fixes #11409) (#11440) (#11466) @gnodet
- [maven-4.0.x] Fix BOM packaging in consumer POMs (#11427) (#11464) @gnodet
- [maven-4.0.x] Fix field accessibility leak in EnhancedCompositeBeanHelper (#11425) (#11433) @gnodet
- Fix a
ConcurrentModificationException(#11429) @desruisseaux
📝 Documentation updates
- [Backport 4.0.x] Fix Javadoc about default value of consumer POM flattening (#12562) @gnodet
- [Backport 4.0.x] [ISSUE-10329] - Document behaviour of UrlNormalizer (#12296) @gnodet
- Add deprecation Javadoc to XmlNode constants and methods (backport #11576) (#12295) @gnodet
- [Backport 4.0.x] Update lifecycles reference to point to LifecycleRegistry (#12292) @gnodet
- [Backport 4.0.x] Document deprecation rationale for Artifact version constants (#12290) @gnodet
- fix doc cross references (#12273) @hboutemy
- document modelVersion supported values (#11810) @hboutemy
- [maven-4.0.x] improve align in dependency graph (#12015) @hboutemy
- document supported values: 4.0.0 and 4.1.0 (#11957) @hboutemy
- clarify repository vs deployment repository (#11491) @hboutemy
- fix javadoc group packages (#11455) @hboutemy
- update links (#11452) @hboutemy
- adapt documentatiion directories (#11450) @hboutemy
- add maintained branches (#11447) @hboutemy
- improve dependency graph rendering (#11445) @hboutemy
👻 Maintenance
- Add Apache license headers to fix ATR concerns (#12613) @gnodet
- Add DefaultLookupTest for lookupOptional NPE fix (#12385) @ascheman
- [Backport 4.0.x] [MNG-8425] - Fix mvnenc init saving invalid master source configuration (#12564) @gnodet
- push-to-atr profile for source+binaries in apache-maven subproject (#12448) @hboutemy
- configure ATR project (#12449) @hboutemy
- Forward-port #11985: remove redundant required MDO attrs (#11979) (#12347) @gnodet
- Forward port Maven 3.10.0 PluginDependenciesResolver changes (#12335) @cstamas
- [Backport 4.0.x] Move model SPI interfaces from maven-impl to maven-api-spi (#12289) @gnodet
- Deprecate testing classes in org.apache.maven.api, add new ones in org.apache.maven.testing (#12277) @gnodet
- Backport #12256: Centralize XXE hardening for StAX XML parsers (#12269) @gnodet
- Refactor JUnit extensions to avoid using static fields. (#12202) @slawekjaranowski
- [4.0.x] Fix mvnup effective model analysis for CI-friendly parent versions (#12230) @gnodet
- [4.0.x] Filter project repos with uninterpolated property expressions (#12229) @gnodet
- [4.0.x] Bump exec-maven-plugin target to 3.5.0 and fix PLUGIN_UPGRADES inconsistencies (#12228) @gnodet
- [4.0.x] Use request properties consistently for CI-friendly version interpolation (#12227) @gnodet
- [4.0.x] Bump scala-maven-plugin upgrade target from 4.9.2 to 4.9.5 (#12226) @gnodet
- [4.0.x] Fix mvnup PLUGIN_UPGRADES for compiler and exec plugins (#12225) @gnodet
- [4.0.x] Remove invalid combine.self and combine.children attributes in mvnup (#12224) @gnodet
- [4.0.x] Fix mvnup plugin upgrade for versions locked by parent build/plugins (#12223) @gnodet
- [4.0.x] Fix mvnup: use effective model to resolve properties from remote parents (#12222) @gnodet
- [4.0.x] Fix mvnup recommending non-existent maven-enforcer-plugin:3.5.2 (#12156) @gnodet
- [maven-4.0.x] Fix #12080: mvnup - comment out dependencies with undefined property expressions (#12099) @gnodet